Chapter 12 — Authorized offensive security and red team: data flows
Lesson map
Lesson 12 published. Map, example, EX034.
flowchart TD
N0["Learning outcomes"]
N1["12.1 Flows, not boxes"]
N2["12.2 Personal and operational data"]
N3["12.3 Cross-border and vendor paths"]
N4["12.4 Retention clocks"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX034"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["12.1 Flows, not boxes"]
N2["12.2 Personal and operational data"]
N3["12.3 Cross-border and vendor paths"]
N4["12.4 Retention clocks"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX034"]
[Learning outcomes]
|
v
[12.1 Flows, not boxes]
|
v
[12.2 Personal and operational data]
|
v
[12.3 Cross-border and vendor paths]
|
v
[12.4 Retention clocks]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX034]
Learning outcomes
You will (1) draw a data-flow diagram for one TRT service; (2) mark where assessment evidence and personal data may appear; (3) apply data-minimisation and redaction rules; (4) choose storage and retention that match the agreement.
12.1 Flows, not boxes
A data-flow diagram shows what moves: a passenger request to the timetable API, a staff login to the portal, a log line to the SIEM, a backup to storage. Boxes alone do not reveal where copies of sensitive data land. Assessments that touch those paths can create new copies; the agreement must say what happens to them.
For ENG-712 Priya draws the passenger-to-API and staff-to-portal-to-SIEM flows before the engagement starts. Any finding that relies on log evidence then cites the flow it came from, and each flow is checked for personal data before the evidence design is approved. A diagram of boxes without arrows would hide exactly the retention duties that apply when a log line is copied into the evidence vault.
12.2 Personal and operational data
Even a transit operator holds personal data — staff identifiers, sometimes passenger account details on adjacent systems. Operational data such as driver rosters and maintenance schedules can also be sensitive. Capture the minimum that proves a finding; mask the rest before filing.
In ENG-712 login screenshots keep the staff email domain as proof but have the local part masked before they enter the vault. Roster extracts are treated as sensitive even though they are not classic personal data, because they reveal who works where and when. Both kinds of evidence run on the same 90-day retention clock as the service banners.
12.3 Cross-border and vendor paths
If logs are shipped to a vendor SIEM in another country, evidence may leave the jurisdiction the agreement assumed. Note the path before the engagement; do not discover it in the report draft.
Priya names any cross-border SIEM path in the agreement before the first log is shipped, treating it like a host that needs scoping. If the vendor announces mid-window that it has moved regions, log shipping pauses and a decision meeting is held. She will not invent consent for a transfer that the signed agreement never contemplated.
12.4 Retention clocks
Start a retention clock when evidence is collected. When the agreement's period ends, delete or return the data and record that you did. Indefinite "just in case" stores are a liability.
ENG-712 runs a 90-day clock that ends with delete or return and a written destruction record naming who deleted the evidence and when. The record is hashed into the handoff pack next to the access-control change on the vault. Keeping copies for training would need a new agreement; without one, the handoff checklist fails.
Worked example
Priya maps the staff-portal login: browser → reverse proxy → portal app → directory; and a parallel flow portal app → application log → SIEM. A screenshot of a failed login shows a staff email address. She masks the local part before filing, keeps the domain to prove it was a staff account, and stores the file under ENG-712 with a 90-day retention note from the agreement.
Synthetic case. The login flow and the masked screenshot are invented.
Errors and limits
Redaction that leaves the secret recoverable (cropping that still shows the password in EXIF, for example) is not redaction. This chapter does not cover legal regimes in detail; follow your counsel and the agreement.
Exercises
- EX034 — Extra copy. Name one place a timetable API request might be copied besides the application server, and why an assessor cares. Rubric: 3 = e.g. reverse-proxy logs / SIEM / CDN / WAF — each is a potential evidence and retention location; 2 = names place; 1 = nowhere; 0 = none.
- EX035 — Masking choice. A screenshot shows staff email
alex.rivera@trt.example. What does Priya keep and what does she mask? Rubric: 3 = mask local part; keep domain or role marker to prove staff context; 2 = mask all; 1 = keep full address; 0 = none. - EX036 — Retention end. ENG-712's agreement says 90 days. What two actions close the clock? Rubric: 3 = delete or return evidence + record the destruction/return; 2 = one action; 1 = keep forever; 0 = none.
Synthesis
Follow the copies, minimise and mask, and close the retention clock in writing.
Continue studying — chapter 12 of 30
← Chapter 11 (draft) · Course chapter index · Chapter 13 (draft) →